Extracted

• • Target

    meaterialorders.exe

  • Size

    996KB

  • MD5

    fc9a563b2c81a36b5faa6832695d59ef

  • SHA1

    1f49d88c095ac07bacc27b2de94affb5b4246611

  • SHA256

    a6c334e0bf23b3228bd86b455ee16a5f9675ac453f8e5ab0de66ab8824cecaa0

  • SHA512

    3c5dd0db3d35ef54ff641356ded4248806a0a7c83cd0c99518ffc2551a7fb6db09f95f4d5176db7af5344f9cada6c602ab1994d947c68a649c816e9c447a596a

  • SSDEEP

    24576:adNH1IqAS7ydN41p5Mtzqonte45WxGUSJw/BA0Uk5Wfw:aTvAHMhmZnk4wV/BJUk5WY

  Score

  10^/10

  warzoneratcollectioninfostealerratspywarestealer

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2